feat(renovate): match SHA-pinned actions in .rst documentation - #105
Merged
Conversation
Documentation examples pin actions by SHA like workflows do, but no manager covered them, so every pin in a .rst file drifted until someone bumped it by hand. A match needs digest, whitespace and a `# vN` comment together, which leaves placeholder SHAs and deliberate counter-examples untouched. Signed-off-by: Simon Bärlocher <s.baerlocher@sbaerlocher.ch>
No renovate-config-validator runs on this repo, so a loosened regex would first surface as Renovate rewriting a documented "wrong" example into its opposite. The regex is read out of the preset with jq rather than restated, so the guard cannot drift away from the artifact it protects. Signed-off-by: Simon Bärlocher <s.baerlocher@sbaerlocher.ch>
Without a job the guard is dead weight, and the workflow-input-injection guard next to it is the precedent. Only jq and grep -P are needed, both present on the runner. Signed-off-by: Simon Bärlocher <s.baerlocher@sbaerlocher.ch>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
customManagertorenovate-base.jsonthat updates SHA-pinned GitHub Actions inside.rstdocumentation examples. Documentation pins drifted silently: inarillso/guide9 of 10 pinned actions are behind, and a hand-fix only holds until the next release.# vNcomment together. That structural condition is what spares placeholder SHAs, date-tagged pins and the deliberate@v4/@maincounter-examples, rather than a blacklist that has to be maintained.renovate-config-validatorruns here, so a loosened regex would otherwise first surface as Renovate rewriting a documented "wrong" example into its opposite. The test reads the regex out of the preset withjqand selects the manager by its file pattern, so neither a copy nor an array index can drift.renovate-actions,-ansibleand-goextendrenovate-baseand inherit the manager.renovate-alpine.jsonhas noextendsand does not; repositories without SHA-pinned.rstfiles are unaffected because the pattern never matches.Test plan
scripts/tests/test-renovate-rst-manager.shpasses, and fails withno customManager ... declares the /\.rst$/ file patternwhen the manager is removedrst/guide/development/cicd.rst: 24 matches on the expected lines, 0 placeholders, 0 mutable refs, 0 date-tagsshellcheckandactionlintclean; the existingtest-workflow-input-injection.shguard still passes